---
title: "POST /gate/scan"
method: POST
path: "/gate/scan"
tags: ["gate"]
---

# POST /gate/scan

`POST /gate/scan`

## Request body

- ScanRequest
  - `content` string, required — The untrusted content to scan.
  - `mode` 'fast' | 'thorough'
  - `source_url` string, nullable — Optional URL the content was fetched from (provenance for the flywheel).

## Response `200`

Scan verdict

- ScanResponse
  - `injection` InjectionReport, required
    - `families` string[], required
    - `score` number, double, required — Injection score, 0.0..=1.0.
    - `spans` SpanReport[], required
      - `end` integer, required
      - `family` string, required
      - `start` integer, required
  - `latency_ms` integer, required
  - `links` LinkVerdict[], required
    - `entity` string, required
    - `sources` integer, required
    - `url` string, required
    - `verdict` string, required — One of `malicious` | `suspicious` | `clean` | `unknown`.
  - `links_truncated` boolean, required
  - `mode` 'fast' | 'thorough', required
  - `sanitized_content` string, nullable
  - `source` LinkVerdict
    - `entity` string, required
    - `sources` integer, required
    - `url` string, required
    - `verdict` string, required — One of `malicious` | `suspicious` | `clean` | `unknown`.
  - `verdict` string, required — One of `block` | `warn` | `allow`.

## Other responses

- `400` — Missing or oversize content
- `401` — Unauthorized
- `429` — Scan quota exceeded

## Changes

- **2026-08-26** `c990a0940b7d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/gate/scan/post.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ismalicious/ismalicious-threat-intelligence-api/revisions/c990a0940b7d/schema)